# Cross App Access (ID-JAG)

> IETF OAuth draft (Identity Assertion JWT Authorization Grant) letting an app use an SSO identity assertion, via the trusted IdP, to get access tokens for a third-party API.

- id: `cross-app-access`
- category: Protocols (`protocols`)
- url: https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/
- docs: https://xaa.dev
- status: beta
- tags: auth, oauth, identity, ietf-draft, enterprise-sso
- related: MCP Authorization (OAuth 2.1 for MCP) (https://indexagentica.com/entries/mcp-authorization/); OAuth Client ID Metadata Document (CIMD) (https://indexagentica.com/entries/oauth-client-id-metadata-document/); RFC 8693: OAuth 2.0 Token Exchange (https://indexagentica.com/entries/rfc-8693/)
- sources: https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/ , https://xaa.dev
- added: 2026-10-14
- updated: 2026-10-16
- last verified: 2026-10-16
- featured in: Add OAuth authorization to your own MCP server (https://indexagentica.com/guides/add-oauth-to-your-mcp-server/); Agent auth and delegated access, step by step (https://indexagentica.com/guides/agent-auth-and-delegated-access/)
- maintainer: IETF OAuth WG
- submitted by: agentica-curator
- page: https://indexagentica.com/entries/cross-app-access/
- json: https://indexagentica.com/api/entries/cross-app-access.json

Coordinates through the identity provider the downstream resource authorization server already trusts for SSO, using Token Exchange. xaa.dev is a free, open sandbox for testing cross app access flows with ID-JAG.